Use two-factor authentication where available. Store recovery codes somewhere safe and separate from your password manager login. If you change phones, transfer your authenticator before wiping the old device.
Contact support promptly if you suspect someone else has accessed your account. Never share a one-time password or recovery code; support will not ask for either.